Home Malware Programs Backdoors Backdoor.Sesent

Backdoor.Sesent

Posted: July 11, 2011

Backdoor.Sesent is a backdoor Trojan that creates security vulnerabilities on your PC to allow criminals to attack the computer remotely with Backdoor.Sesent's assistance. As a very new PC threat, Backdoor.Sesent may avoid being detected by out of date anti-virus software and can exploit unpatched vulnerabilities in certain file types to attack your computer. Remote attacks that are caused by Backdoor.Sesent can lead to loss of confidential information, excessive system resource usage, file destruction or damage and even having a criminal entirely take over your computer. You can delete Backdoor.Sesent with any good anti-virus program, although you may need to update your preferred software to find and remove Backdoor.Sesent with efficiency.

Backdoor.Sesent, the Backdoor Opener with Multiple Means of Access

The backdoor Trojan Backdoor.Sesent had its entrance in early July of 2011, and as such, may require the very latest in updates to remove from your PC. In addition to keeping your standard anti-virus and security software updated, you may also wish to:

  • Update your PDF file reader. Backdoor.Sesent has been reported to exploit vulnerabilities in .pdf files to attack computers; updating whatever application you use for reading .pdf files will reduce the likelihood of such a security loophole being present.
  • Update your email client. Some sources report Backdoor.Sesent spreading via spam email messages as a file attachment. An updated email client will help you notice these Backdoor.Sesent-infected files before you attempt to open them. As a general precaution, try to avoid downloading a file from an email until you've confirmed its safety from an independent source, even if you know the message's sender.
  • Update your web browser. Backdoor.Sesent, like many other Trojans, can make use of drive-by-download exploits to infect your PC. In usual circumstances, these exploits will use Flash or JavaScript embedded in a website or an advertisement to install Backdoor.Sesent. As such, disabling Flash or JavaScript in a selective fashion is yet another way to guard yourself against a Backdoor.Sesent infection route.

Backdoor.Sesent can attack all versions of Windows, from the ancient Windows 95 to the brand-new Windows 7.

The Aftermath of a Backdoor.Sesent Infection

Backdoor.Sesent's first objective is to create a security hole in your computer. This lets remote and anonymous hackers launch attacks on your PC in a variety of ways, often by using a Remote Administration Tool or RAT. These remote attacks can be as mild as installing other programs or as severe as taking complete control over your PC, and thus, any Backdoor.Sesent infection is a severe security and privacy threat.

Some possible signs of Backdoor.Sesent creating a backdoor include an opened network port, altered security settings (particularly regarding which programs are set to be 'exceptions' and thus, ignored by your security) and a disabled firewall. Backdoor.Sesent has been confirmed to modify certain system settings without permission.

Despite the many problems that come along with a Backdoor.Sesent infection, Backdoor.Sesent may not even show itself visibly in any significant way. Even memory processes that are related to Backdoor.Sesent may not be identifiable, since Backdoor.Sesent has been known to inject Backdoor.Sesent's own code into native Windows files to conceal itself. Checking a memory process for excessive memory usage is one of the few ways to detect a Backdoor.Sesent-infected file without anti-virus software.

The advanced nature of a Backdoor.Sesent infection makes the usage of anti-virus or other threat-detecting software invaluable for finding and removing Backdoor.Sesent, although having all updates for this software is equally important.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\dllcache\aic982x.sys
    2 %System%\dllcache\pit70ux.sys
    3 %System%\esent64.exe
    4 %System%\wmvds32.exe
    5 %Temp%\lsass.exe
    6 %Temp%\svchost.exe
    7 %UserProfile%\Cookies\index64.dat
    8 %Windir%\Installer\b28892x.msi
    9 %Windir%\Installer\bc87ee.msi

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\RunOnce\"IgfxTray" = "[THREAT FILE NAME]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8ADE92E4-D32E-0B4B-F53F-6C7E3677DFB3}\"StubPath" = "[THREAT FILE NAME]"HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Secdrv\"ImagePath" = "system32\369877.tmp"
Loading...